#1000 Add version field to the service configuration schema Pull request opened by javuto Add a

version

field to the service configuration schema Problem osctrl services silently accept YAML configuration files written for any release. When fields are added, renamed, or removed, operators get no signal that their file predates the binary — new options are simply missing and fall back to defaults with no explanation. There is also no signal the other way: an old binary loading a file from a newer release ignores unknown fields quietly. Change Introduce a top-level

version

integer on the YAML schema and emit a startup warning when it does not match the version the binary supports. •

pkg/config/version.go

(new): defines

ConfigVersion = 1

and

ConfigVersionWarning(fileVersion int) string

, which returns a human-readable message for missing (

0

), older, or newer file versions and an empty string when they match. Version skew is intentionally a warning, never a load error, so existing deployments without the field and files from future releases keep starting. • `pkg/config/types.go`: add

Version int

to

TLSConfiguration

and

APIConfiguration

. • `pkg/config/utils.go`: stamp generated config files (

GenerateTLSConfigFile

,

GenerateAPIConfigFile

) with

ConfigVersion

so

config-generate

output always carries the current schema number. •

cmd/tls/main.go

, `cmd/api/main.go`: call

ConfigVersionWarning

right after

v.Unmarshal

and

log.Warn

the result, before value validation. •

deploy/config/tls.yml

, `deploy/config/api.yml`: set

version: 1

with an explanatory comment. Tests •

pkg/config/version_test.go

(new): table-driven coverage for the four branches of

ConfigVersionWarning

(current, missing, older, newer). •

cmd/tls/config_test.go

, `cmd/api/config_test.go`: •

TestSampleTLSConfigLoads

/

TestSampleAPIConfigLoads

now assert the shipped sample file's

version

equals

ConfigVersion

, so a schema bump that forgets the sample file fails CI. • New

TestConfigVersionMismatchDoesNotFailLoad

verifies a file with

version: 999

still loads and parses, locking in the "warn, don't fail" contract. Validation •

go test ./pkg/config ./cmd/tls ./cmd/api

•

go test ./...

Risk / notes • Additive and reversible: files without

version

continue to load and only produce a warning. No persistence, auth, or osquery-handler behavior changes. • Future schema changes should bump

ConfigVersion

and update

deploy/config/*.yml

in the same PR; the sample-config tests enforce this. jmpsec/osctrl